CodeQL actions/missing-workflow-permissions: chain-endpoints.yml, lock.yml, pr-any.yml, test-nightly.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.
A new PR job, test:slow, starts a bizinikiwi dev node and runs the .slow.
specs. The nightly test:all includes them, so it starts the same node.
start-dev-node.sh pins the image by digest and fails when the node does not
answer, so the specs never run without one.
The nightly run was cancelled at its 120-minute limit every night until
it was disabled. The cause was the Elapsed clock, which kept the test
process alive and is fixed (a909c07): test:all now completes in about
80 seconds. A 20-minute limit leaves a wide margin and turns a future
hang into a failure within the hour rather than two runner-hours.
SatoshiQaziMuhammed